[1.0.7] - 2026-07-07

Fixed

• macOS wheels are now self-contained: OpenSSL is vendored and statically linked
  like the Linux wheels. Previously the published macOS wheel baked in an absolute
  path to Homebrew's openssl@3 and failed to import on machines without that exact
  install (#276)

[1.0.6] - 2026-04-08

Fixed

• Fixed a bug where the verification incorrectly picked the leaf certificate. This
  allowed an attacker who could modify a timestamp response to make a
  legitimately-signed timestamp from TSA-A pass verification as if it came from
  TSA-B.

[1.0.5] - 2025-09-23

Changed

• Bump pyca/cryptography dependency upper bound to version 47

[1.0.4] - 2025-08-11

Changed

• Timestamps are now verified with the timestamp time as reference time like the RFC
  says: this means that the certificate chain no longer needs to be valid at current
  time, it is enough for it to have been valid at timestamp time
  (#174)

[1.0.3] - 2025-06-20

Fixed

• Exposed verify_message in the actual Verify interface, not just the implementation
  (#153)

• Fixed a bug where verification performed insufficient signature checks on
  the timestamp response itself, rather than the response's certificate chain

Changed

• Added HashAlgorithm to exports of the base package module (#143)

• Added verify_message method to Verifier class (#144)

• Slight refactoring of the tests to ease how to test with multiple TSA (#145)

• Changed return value of VerifierBuilder.build() from _Verifier to Verifier: This is technically
  an API change but should have minimal user impact. (#147)

Fixed

• Fixed spelling of hash_algorithm parameter in TimestampRequestBuilder class (#131)

What's changed?

Fixed

• The Verifier now enforces that the EKU (Extended Key Usage) explicitly includes the id-kp-timeStamping OID (#120)

• The Verifier now searches for the leaf certificate in the Timestamp Response instead of using the first one provided (#121)

New Contributors

• @pjrobertson made their first contribution in #121

Full Changelog: v1.0.0...v1.0.1

What's Changed

• TimestampRequest now accepts setting the hash algorithm to SHA256 (in addition to SHA512) (#93)

Full Changelog: v0.1.2...v1.0.0

Changed

• Moved maturin dependency from main project dependencies to development dependencies since it's only needed for development tasks (88)

• Relax cryptography version requirement (91)

What's Changed

Changed

• rfc3161-client release 0.1.0 was previously published and yanked on PyPI, preventing republication (https://github.com/trailofbits/rfc3161-client/pull/85)

What's Changed

• rfc3161-client is now in beta (https://github.com/trailofbits/rfc3161-client/pull/82).

Added

• TimestampResponse now has a as_bytes method to retrieve the original request bytes (#62)

Full Changelog: https://github.com/trailofbits/rfc3161-client/compare/v0.0.3...v0.0.4

What's changed

Added

• Magic method (__eq__ and __repr__) has been added for TimestampResponse and TimestampRequest (#48)

Fixed

• The CI now correctly builds wheels for Windows (49)

What's Changed

Added

• Magic methods (__hash__ and __repr__) have been added for TimestampResponse and TimestampRequest (#32)
• VerifierBuilder is now the only way to create a Verifier (#35)

Fixed

• The version is now correctly sourced from pyproject.toml (#30)
• The nonce generation no longer fails sporadically (#33)
• Accuracy now correctly accepts valid inputs and enforce range invariants (#43)
• Fixes a bug in how TSTInfo was parsed (#45)

Changed

• The public API is now available directly from the main package module (#36)

Full Changelog: https://github.com/trailofbits/rfc3161-client/compare/v0.0.1...v0.0.2